Public
- Public
- Network
- Groups
- Featured
- Popular
- People

Conversation

Notices

Embed this notice
Alex Gleason (alex@gleasonator.com)'s status on Tuesday, 15-Aug-2023 06:55:14 JST Alex Gleason

I just patched the Mostr bridge, because apparently Deno's fetch implementation is vulnerable to fetching "file://" URIs. Thankfully I was parsing the response data before returning anything, but TIL the Deno devs implemented this as a "feature" on purpose. 🤦♂️ Nobody is safe from Rust.

https://gitlab.com/soapbox-pub/mostr/-/merge_requests/66
In conversation about a year ago from gleasonator.com permalink
Attachments
1. Domain not in remote thumbnail source whitelist: gitlab.com
  
  Add safeFetch implementation to prevent pwning the server with file URIs (!66) · Merge requests · Soapbox / Mostr · GitLab
  
  Apparently Deno has an unsafe fetch implementation. Mildly infuriating. More here: https://github.com/denoland/deno/issues/11925#issuecomment-1678084346
- feld likes this.
- Embed this notice
  Coyote (coyote@social.singing.dog)'s status on Tuesday, 15-Aug-2023 07:26:33 JST Coyote
  in reply to
  
  @alex Isn’t Deno purposefully trying to act like a browser? If it is, you might want to check that it doesn’t also support bookmarklets too.
  
  In conversation about a year ago permalink
  
  Alex Gleason likes this.

Feeds